Weaknesses of type CWE-79

29,637 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-54316MEDIUMWordPress Restaurant & Cafe Addon for Elementor plugin <= 1.5.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-12907MEDIUMXSS in Kentico 7EPSS 0.4%CVE-2023-46613MEDIUMWordPress Add to Calendar Button Plugin < 1.5.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-27075MEDIUMA cross-site scripting vulnerability (XSS) in the component microbin/src/pasta.rs of Microbin v1.2.0 allows attackers to execute arbitrary wEPSS 0.4%CVE-2022-1226LOWCross-site Scripting (XSS) in phpipam/phpipamEPSS 0.4%CVE-2024-2325MEDIUMLink Library <= 7.6.6 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2023-47839MEDIUMWordPress eCommerce Product Catalog Plugin <= 3.3.26 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-54314MEDIUMWordPress Primary Addon for Elementor plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-47680MEDIUMWordPress Qi Addons For Elementor Plugin <= 1.6.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-49160MEDIUMWordPress Formzu WP Plugin <= 1.6.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-54308MEDIUMWordPress Cryptocurrency Price Widget plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-0617HIGHLatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.4%CVE-2023-45767MEDIUMWordPress Simple Tweet Plugin <= 1.4.0.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-46069MEDIUMWordPress Ajax Archive Calendar Plugin <= 2.6.7 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-5367MEDIUMKashipara College Management System each_extracurricula_activities.php cross site scriptingEPSS 0.4%CVE-2024-34432MEDIUMWordPress Better Elementor Addons plugin <= 1.4.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-5369MEDIUMKashipara College Management System submit_admin.php cross site scriptingEPSS 0.4%CVE-2023-49745MEDIUMWordPress Spiffy Calendar Plugin <= 4.9.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-3189MEDIUMGutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.37 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2023-45640MEDIUMWordPress WP ULike Plugin <= 4.6.8 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%